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REAL PARTY IN INTEREST 

The real party in interest is HP Centre de Competences Franc S.A.S. in Les Ulis, France. 

RELATED APPEALS AND INTERFERENCES 

There are no related appeals or interferences that will directly affect, be directly affected by or 
have a bearing on the present appeal, that are known to appellant, the assignee, or the 
appellant's patent representative. The Related Proceedings Appendix, attached hereto, states 
"None" 

STATUS OF CLAIMS 

Claims 1-17 are pending on appeal. A copy of the pending claims is presented in the 
CLAIMS APPENDIX. These claims have been finally rejected. Rejections of claims 1-17 
are appealed. 

STATUS OF AMENDMENTS 

No amendments are being filed with this Appeal Brief or are outstanding. 

SUMMARY OF CLAIMED SUBJECT MATTER 

The invention relates to a system and method for protecting the privacy of a user 
during communication with a third party service provider, (page 1, lines 6-7). The privacy 
protection system utilizes a user side device that has a true user profile containing user related 
profile data. A profile generator is able to generate at least one false user profile, which 
includes profile data that is not the same as the profile data in the true user profile. The at 
least one false profile is transmitted to a third party with a data request, and a response is 
received from the third party based upon the false user profile. A response analyzer is then 
able to determine a response related to the true user profile from the received response that 
relates to the false user profile. See, for example, the description on pages 6 through 9 of the 
specification and Figures 3 and 4 of the drawings. 
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Independent claim 1 recites a privacy protection system (page 1 , lines 6-7) including a 
user side device (22) provided with a true user profile (user profile storage memory 22) which 
comprises user related profile data (page 6, lines 1-8 and 21-25), a profile generator (fake 
identity generator 24) operable to generate at least one false user profile (fake user identities 
26a-26c) which includes profile data not the same as the user's profile data (page 7, lines 1- 
5), transmission means operable to transmit the at least one false user profile to a third party 
(page 7, lines 1-5; web service providers 14-18) with a data request, a receiving unit (28a- 
28c) operable to receive a response from the third party generated on the basis of the false 
user profile(page 7, lines 5-8; page 8, lines 23-25), and a response analyser (response analyser 
30) operable to determine from the received response a response related to the true user 
profile (page 8, lines 25-30). 

Independent claim 8 recites a privacy protection method (page 1 , lines 6-7) including 
the steps of providing at a user side a true user profile (user profile storage memory 22) 
comprising user related profile data (page 6, lines 1-8 and 21-25), providing a profile 
generator (fake identity generator 24) which generates at least one false user profile (fake user 
identities 26a-26c) which includes profile data not the same as the true user profile data (page 
7, lines 1-5), transmitting (42) the at least one false user profile to a third party (page 7, lines 
1-5; web service providers 14-18) with a data request, receiving (Fig. 4, step 44) a response 
(28c-28c) from the third party generated on the basis of the false user profile(page 7, lines 5- 
8; page 8, lines 23-25), and providing a response analyser (response analyser 30) which 
analyses the response to determine from the received response a response related to the true 
user profile (page 8, lines 25-30). 

Dependent claim 2 recites a system according to claim 1, wherein the profile generator 
(fake identity generator 24) is operable: 

a) to generate a plurality of user profiles of which only one is a true user 
profile (page 9, lines 15-19), or 

b) to generate a plurality of user profiles none of which includes a true 
user profile (page 9, line 23 to page 10, line 2), or 
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c) to split user data forming the true user profile into separate parts with 
the separate parts being included in false user profiles to which are added false user data 
(page 7, lines 21-25), or 

d) to generate entirely false profiles none of which contains any true user 
data (page 10, lines 10-14). 

Dependent claim 9 recites a method according to claim 8, wherein: 

a) a plurality of user profiles is generated of which only one is a true user 
profile (page 9, lines 15-19), or 

b) a plurality of user profiles is generated none of which includes a true 
user profile (page 9, line 23 to page 10, line 2), or 

c) entirely false profiles are generated none of which contains true user 
data (page 10, lines 10-14), or 

d) a plurality of false user profiles are generated which provide a spread 
of user data enabling interpolation of the received responses (page 10, lines 18-26). 

Dependent claim 12 recites a system according to claim 1, wherein said transmission 
means are operable to transmit a plurality of false user profiles to a third party with a data 
request (page 8, lines 20-21; Fig. 4, step 24). 

Dependent claim 13 recites a system according to claim 1, wherein the false user 
profile contains at least one item of user identification data and at least one other item of user 
data (page 6, lines 1-8). 

Dependent claim 14 recites a system according to claim 1, wherein the false user 
profile contains at least one item of data from the true user profile corresponding to a user 
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field and at least one item of false data corresponding to a different user field (page 8, lines 
18-21; Figure 4, step 42). 

Dependent claim 15 recites a method according to claim 8, wherein said transmission 
means are operable to transmit a plurality of false user profiles to a third party (14-18) with a 
data request (page 8, lines 20-21; Fig. 4, step 24). 

Dependent claim 16 recites a method according to claim 8, wherein the false user 
profile contains at least one item of user identification data and at least one other item of user 
data (page 6, lines 1-8). 

Dependent claim 17 recites a method according to claim 8, wherein the false user 
profile contains at least one item of data from the true user profile corresponding to a user 
field and at least one item of false data corresponding to a different user field (page 8, lines 
18-21; Figure 4, step 42). 

GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

The grounds of rejection to be reviewed on appeal are: 

(1) : whether the examiner erred in rejecting claims 1, 2 and 6-1 1 under 35 U.S.C. § 
102(b) as being anticipated by U.S. Patent 5,245,656 to Loeb et al. (hereinafter "Loeb"), and 

(2) : whether the examiner erred in rejecting claims 3-5 under 35 U.S.C. § 103(a) as 
being unpatentable over Loeb as applied to claim 1 and further in view of U.S. Patent 
5,754,935 to Herz et al. (hereinafter "Herz"). 

ARGUMENT 

I, It is respectfully submitted that the final rejection of claims K 2 and 6-1 1 under 35 U.S.C. 
§ 102(b) is erroneous for at least the following reason. 

L Independent claims 1 and 8: 

-5- 
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Independent claim 1 recites (with emphasis added): 

A privacy protection system including a user side device (22) provided with a true 
user profile which comprises user related profile data, a profile generator (24) operable 
to generate at least one false user profile (26a-26c) which includes profile data not the 
same as the user's profile data, transmission means operable to transmit the at least one 
false user profile to a third party (14-18) with a data request, a receiving unit (28a-28c) 
operable to receive a response from the third party generated on the basis of the false user 
profile, and a response analyser (30) operable to determine from the received response a 
response related to the true user profile. 

Thus, the privacy protection system utilizes a user side device that has a true user 
profile containing user related profile data. The profile generator is able to generate at least 
one false user profile, which includes profile data that is not the same as the profile data in the 
true user profile. The at least one false profile is transmitted to a third party with a data 
request, and a response is received from the third party based upon the false user profile. A 
response analyzer is then able to determine a response related to the true user profile from the 
received response that relates to the false user profile. See, for example, the description on 
pages 6 through 9 of the specification and Figures 3 and 4 of the drawings. 

Loeb is directed towards a security method for protecting the identity of users. 
Specifically Loeb teaches transmitting the identity of an end-user station U to a name 
translation station, that translates the identity U into a pseudonym U\ The pseudonym U* is 
transmitted to a filter station, and then to a service provider station. The service provider 
station transmits encrypted information describing available services to the filter station. At 
the filter station, the encrypted information is compared with an encrypted user profile [Pr] of 
the end-user station to determine what information from the encrypted description of services 
to send to the end-user station. The determined information is then sent in encrypted form to 
the name translator station, and then to the end-user station where it is decrypted. (Abstract 
of Loeb). This type of communication ensures the privacy of the actual identity of the end- 
user. 
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Loeb fails to teach the features of the invention as claimed, specifically failing to teach 
"a profile generator (24) operable to generate at least one false user profile (26a-26c) which 
includes profile data not the same as the user's profile data." (Independent claim 1). As 
mentioned above, Loeb teaches an end user identity U of an end user station. Loeb also 
teaches a user profile of the end user station, which is stored at a filter station. Further, Loeb 
teaches that the end user identity U is translated into a pseudonym IP, to ensure that the 
actual identity U of the end user station is not revealed to the filter station and information 
provider station (column 2, lines 53-66). The end user identity U is in no way equivalent to 
the false user profile of the invention as claimed. First, Loeb teaches that there is no way to 
associate a user profile with an actual end user identity, (column 2, lines 63-66). They are 
separate items. Loeb teaches that the user profile Pr contains the real profile data of the end 
user station. Further, there is no teaching or suggestion in Loeb of creating a false profile 
based upon the user profile Pr of Loeb. The pseudonym LP is also in no way equivalent to the 
false user profile of Loeb, and is a separate and distinct item associated with the identity U. 
Loeb explicitly teaches: 

"In the name translator station 30, the memory 32 contains a translation 
table which maps an actual identity U of each end-user station 14, 16 
into a pseudonym IP. The name translator station 30 translates the 
identity U of a user station 14, 16 into a pseudonym IP so that neither 
the filter station 40 nor information provider station 20 ever learns the 
actual identity U of an end-user station requesting service, but rather 
learns only the pseudonym IP ." (column 2, lines 53-61; emphasis added) 

Thus, the psueodonym IP is solely a translation of the end user identity U, which does not 
contain any profile data. Further, Loeb teaches that: 

"The privacy of the actual information transmitted from the service 
provider to the end-user is protected. The privacy of a profile maintained 
for each end-user at a central filter location is also protected. This is 
accomplished by using encryption techniques to insure that no logical 
entity is aware of the identity of the end-user, and also aware of the 
end-user profile and content of the information the end-user receives. 

-7- 
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The most that any entity knows is either the identity of the end-user 
or the contents of the end-user profile and the contents of the 
delivered information." (column 2, lines 1-11; emphasis added) 

Here, Loeb explicitly states that the user profile and user identity are two separate entities that 
are specifically not provided or associated with one another. 

To that end, Applicants submit that Loeb fails to teach or disclose a profile generator 
operable to generate at least one false user profile which includes profile data not the same as 
the user's profile data. The final Office Action does not clearly specify how Loeb teaches the 
feature of "a profile generator (24) operable to generate at least one false user profile (26a- 
26c) which includes profile data not the same as the user's profile data." Rather, the Office 
Action states that Loeb teaches "generating a false user profile." (Section 8.b of the Office 
Action). The Examiner has interpreted the pseudonym U' to be the false user profile of the 
invention as claimed (Section 8.b of the Office Action) However, Applicants respectfully 
submit that the pseudonym U' is a translation of the actual end-user identity U. As 
established above, the actual end-user identity U does not contain any profile data. Thus, 
translating the actual end-user identity would not result in a pseudonym that contained profile 
data. There is no teaching or suggestion in Loeb that the pseudonym U' is augmented with 
further profile information. Thus, Applicants respectfully submit that translating the actual 
end-user identity U into a pseudonym is not equivalent to generating a false user profile. 

The Office Action further states, in the Response to Arguments, that: 

"Loeb also teaches generating a false user profile which includes profile 
data not the same as the users profile data (column 4, lines 26-28). The 
pseudonym is provided with the true user profile. Together they make a 
false user profile since the identity is not the true user identity." (Section 2, 
lines 7-10) 

However, Applicants respectfully submit that the Examiner's interpretation of Loeb with 
regards to the pseudonym U' is incorrect. There is no teaching or suggestion in Loeb that the 
pseudonym is provided with the true user profile. The Examiner interprets the actual end- 
user identity to be the true user profile, as established above. The inclusion of the pseudonym 
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U' with the actual end-user identity U would be in direct contrast to the teachings of Loeb. 
Specifically, Loeb teaches: 

"In the name translator station 30, the memory 32 contains a translation 
table which maps an actual identity U of each end-user station 14, 16 
into a pseudonym U\ The name translator station 30 translates the 
identity U of a user station 14, 16 into a pseudonym U f so that neither 
the filter station 40 nor information provider station 20 ever learns the 
actual identity U of an end-user station requesting service, but rather 
learns only the pseudonym U' ." (column 2, lines 53-61; emphasis added) 

Thus, Loeb teaches that the pseudonym U' is never transmitted with the end user identity U. 
Rather, the end user identity U is kept private, such that neither the filter station 40 nor the 
information provider station 20 leams the actual end user identity U of the end user station 
that requests service. Thus, Applicants respectfully disagree with the Examiner's 
interpretation that the pseudonym U' is provided with the actual end-user identity U\ 

Further, there is no teaching or suggestion in Loeb that the pseudonym U' "includes 
profile data not the same as the user's profile data," as required by the invention as claimed. 
As established above, the pseudonym U' is merely a translation of the actual end-user identity 
U. Thus, the pseudonym U' does not contain any profile data. However, even if the 
pseudonym U' was incorrectly interpreted to contain profile data, there is no teaching or 
disclosure in Loeb that the profile data would include profile data that was not the same as the 
user's profile data. As mentioned above, there is no mention in Loeb of augmenting the 
pseudonym U' with user profile data. Further, the pseudonym U' is a translation of the end 
user identity U. The end user identity U is a separate and distinct item from the user profile 
Pr in Loeb, as shown above. Thus, Applicants respectfully submit that the psueudonym U' is 
in no way equivalent to a false user profile of the invention as claimed. 

Applicants also consider the case that the end-user profiles are interpreted to be the 
user profile, that includes user-related profile data. Applicants respectfully submit that there 
is no corresponding false user profile taught in Loeb. Loeb teaches that the profile 
information Pr is sent to the name translator station, it is encrypted [Pr], but not translated. It 

-9- 

WASH_21 63940.4 



Atty. Dkt. No. 200207061-2 



is known that [Pr] is only encrypted and not translated because Loeb asserts that an extra 
layer of encryption is provided such that if the layer were not provided, one might be able to 
correlate U and U' based on the profile information [Pr] (column 4, lines 9-15 and 24-35). 
Thus, the profile informations [Pr] and {[Pr]} that are utilized in communication are in fact 
the same profile information, with one or more levels of encryption placed theron. (column 4, 
lines 19-33) Encrypting a user profile is in no way equivalent to generating a false user 
profile containing profile data not the same as the user's profile data. Rather, the profile data 
remains exactly the same, but is provided with security provisions. A key of encryption is 
that the original data is not lost or changed, but merely protected. 

Thus, if the profile data were interpreted to be the user profile including profile data, 
the pseudonym U' of Loeb would still be interpreted to be the generated false user profile that 
includes profile data not the same as that contained in the user profile. However, Applicants 
respectfully submit that, as explained above, the pseudonym U' of Loeb cannot be correctly 
interpreted to be the false user profile of the invention as claimed. Further, Applicants have 
shown above that the pseudonym LT does not contain any profile data that is not included in 
the user profile. Thus, Applicants respectfully submit that the case of the user profile Pr of 
Loeb interpreted to be the user profile would also be invalid. 

Further, the final Office Action does not clearly specify how Loeb teaches the feature of "a 
user side device (22) provided with a true user profile which comprises user related profile 
data." Rather, the Office Action states that Loeb teaches "storing user profile information." 
(Section 8. a of the Office Action). Here, the Office Action interprets the end user identity U 
of Loeb to be the true user profile. The Office Action also responds to Applicants arguments 
submitted previously that Loeb fails to teach this feature of the invention as claimed, because 
the end user identity is separate from the end user profile. In fact, Loeb clearly distinguishes 
between the end-user identity and the end-user profile, asserting that at most, any one entity 
only knows "either the identity of the end-user or the contents of the end-user profile." 
(column 2, lines 8-11) In response to this, the Office Action recites: 

"While the identity is separate from the end user profile it is also associated 
with it. When identity U needs to update its profile information it passes 
its identity and its encrypted profile (column 4, line 8-13) Therefor true 
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identity U is associated with the profile, and is a true profile." (Section 1, 
lines 4-7) 

However, this is in direct contrast to the teachings of Loeb. Specifically, Loeb teaches: 

"In the filter station 40, the memory 42 stores user profiles of the end-user 
stations 14, 16. The user profiles stored at the filter station 40 are each 
associated with a pseudonym U' but there is no way to associate a 
user profile with an actual end-user identity U . The user profiles stored 
at the filter station are encrypted in a manner discussed below." (column 
2, lines 536168; emphasis added) 

Thus, Loeb teaches that the end-user identity is in no way associated with the end user profile. 
Applicants also point to the citation of Loeb provided above, in which Loeb asserts that either 
the end user identity or the end user profile can be known by an entity, but both cannot be 
known by the same entity, (column 2, lines 1-11). Providing both the end user identity and 
the end user profile of Loeb would defeat the Loeb system, which depends on transmitting the 
user profile combined with the pseudonym LP to obtain the correct data. Thus, Applicants 
respectfully submit that Loeb fails to teach the feature of "a user side device (22) provided 
with a true user profile which comprises user related profile data," as in the invention as 
claimed. Further, Applicants submit that the end-user identity U can then no longer be 
interpreted to be the true user profile, because it does not comprise any user related profile 
data. Additionally, the user profile of Loeb could not be interpreted to be the true user 
profile, because it is stored on the filter station 40, not on the end user station. The invention 
as claimed requires a user side device which has the true user profile containing user related 
profile data. 

As such, since there is no teaching or suggestion in Loeb of a privacy protection 
system including a user side device (22) provided with a true user profile which comprises 
user related profile data, a profile generator (24) operable to generate at least one false 
user profile (26a-26c) which includes profile data not the same as the user's profile data, 

transmission means operable to transmit the at least one false user profile to a third party (14- 
18) with a data request, a receiving unit (28a-28c) operable to receive a response from the 
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third party generated on the basis of the false user profile, and a response analyser (30) 
operable to determine from the received response a response related to the true user profile, it 
cannot anticipate independent claims 1 and 8 (whereby independent claim 8 recites similar 
features to those discussed above with respect to claim 1). 

it Dependent claims 2 and 9: 

Dependent claims 2 and 9 are patentable for additional reasons beyond the reasons 
given above for their respective base claim. Dependent claim 2 recites (with emphasis 
added): 

a system according to claim 1, wherein the profile generator (24) is operable: 

a) to generate a plurality of user profiles of which only one is a true user 

profile, or 

b) to generate a plurality of user profiles none of which includes a true 

user profile, or 

c) to split user data forming the true user profile into separate parts with 
the separate parts being included in false user profiles to which are added false user data, or 

d) to generate entirely false profiles none of which contains any true user 

data. 

See, for example, the description on pages 9-11 of the specification. 

Each of the options presented in dependent claim 2 that describe that capability of the 
profile generator detail the ability to generate false profiles (i.e. to generate more than one 
false profile). Applicants respectfully submit that Loeb fails to teach generating more than 
one false user profile. 

As detailed above, the Examiner incorrectly interprets the pseudonym IT of Loeb to 
be the false user profile of the invention as claimed. Loeb explicitly teaches that the 
pseudonym U' is obtained by translating the true user identity U of Loeb, not the user profile. 
Specifically, Loeb teaches: 
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"In the name translator station 30, the memory 32 contains a translation 
table which maps an actual identity U of each end-user station 14, 16 
into a pseudonym LP . The name translator station 30 translates the 
identity U of a user station 14, 16 into a pseudonym U f so that neither 
the filter station 40 nor information provider station 20 ever learns the 
actual identity U of an end-user station requesting service, but rather learns 
only the pseudonym U\" (column 2, lines 53-61; emphasis added) 

Thus, Loeb teaches a one-to-one translation of the actual identity U of a end-user station into 
a pseudonym U\ There is no teaching or disclosure in Loeb that the actual identity U of an 
end-user station would be mapped to more than one pseudonym LP. Thus, Loeb fails to teach 
generating false profiles. 

As such, since Loeb fails to teach or disclose generating false profiles, Loeb cannot 
anticipate dependent claims 2 and 9 (whereby dependent claim 9 recites similar features to 
those discussed above with respect to claim 2) for these further reasons. 

Hi. Dependent claims 12 and 15: 

Dependent claims 12 and 15 are patentable for additional reasons beyond the reasons 
given above for their respective base claim. Dependent claim 12 recites (with emphasis 
added): 

the system according to claim 1, wherein said transmission means are operable to 
transmit a plurality of false user profiles to a third party (14-18) with a data request . 

See, for example, the description on page 8 of the specification. 

Each of the options presented in dependent claim 2 that describe that capability of the 
profile generator detail the ability to generate false profiles (i.e. to generate more than one 
false profile). Applicants respectfully submit that Loeb fails to teach generating more than 
one false user profile. 

As detailed above, the Examiner incorrectly interprets the pseudonym LP of Loeb to 
be the false user profile of the invention as claimed. Loeb explicitly teaches that the 
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pseudonym LP is obtained by translating the true user identity U of Loeb, not the user profile. 
Specifically, Loeb teaches: 

"In the name translator station 30, the memory 32 contains a translation 
table which maps an actual identity U of each end-user station 14, 16 
into a pseudonym IT . The name translator station 30 translates the 
identity U of a user station 14, 16 into a pseudonym U f so that neither 
the filter station 40 nor information provider station 20 ever learns the 
actual identity U of an end-user station requesting service, but rather learns 
only the pseudonym U\" (column 2, lines 53-61; emphasis added) 

Thus, Loeb teaches a one-to-one translation of the actual identity U of a end-user 
station into a pseudonym U\ There is no teaching or disclosure in Loeb that the actual 
identity U of an end-user station would be mapped to more than one pseudonym U\ Thus, 
Loeb fails to teach generating a plurality of false profiles. Thus, Loeb would be incapable of 
transmitting more than one false user profile to a third party. However, even if it were 
incorrectly assumed that Loeb would be able to generate more than one false user profile, 
Loeb only teaches transmitting one pseudonym U' to the information service provider station, 
(column 4, lines 46-47) 

The Examiner further asserts that "Loeb teaches that there is a plurality of end user 
stations (column 2, lines 55-56) and therefore a plurality of pseudonyms would be passed 
when all of the stations are functioning at the same time." (item 3, lines 2-4 of the Office 
Action). However, Applicants respectfully disagree with this interpretation. The invention as 
claimed requires that "transmission means are operable to transmit a plurality of false user 
profiles to a third party (14-18) with a data request." Thus, a plurality of false user profiles 
are transmitted with a data request. In Loeb, as detailed above, each pseudonym is mapped to 
an end-user identity. There is no teaching or disclosure in Loeb of transmitting more than one 
pseudonym with a data request. The Examiner asserts that multiple transmissions of data 
requests is equivalent to transmitting a plurality of false user profiles with one data request. 
Applicants respectfully submit that multiple transmissions of pseudonyms are not equivalent 
to one transmission of a plurality of false user profiles. 
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As such, since Loeb fails to teach or disclose the system according to claim 1, 
wherein said transmission means are operable to transmit a plurality of false user profiles to a 
third party (14-18) with a data request, Loeb cannot anticipate dependent claims 12 and 15 
(whereby dependent claim 1 5 recites similar features to those discussed above with respect to 
claim 12) for these further reasons. 

iv. Dependent claims 13 and 16: 

Dependent claims 13 and 16 are patentable for additional reasons beyond the reasons 
given above for their respective base claim. Dependent claim 13 recites (with emphasis 
added): 

the system according to claim L wherein the false user profile contains at least one 
item of user identification data and at least one other item of user data . 

See, for example, the description on page 6 of the specification. 

As detailed above, there is no teaching or disclosure in Loeb that the pseudonym U' 
contains any information other than a translation of the user identity. Further, there is no 
indication that even if more than one item of information were stored in the false user profile, 
that at least one item of data would be user identification data, and at least one item of data 
would be other user data. There is no teaching or disclosure in Loeb that the pseudonym 
contains any information other than a translation of the user identity. In fact, as mentioned 
above, the user identity and the user profile of Loeb are two distinct entities. Thus, Loeb fails 
to teach a false user profile that contains user identification data and other user data. 

The Examiner further asserts that "Loeb teaches that the false user profile includes the 
encrypted user profile and the pseudonym (column 4, lines 26-28)." (item 4, lines 3-5 of the 
Office Action). However, Applicants respectfully disagree with this interpretation. In the 
cited passage by the Examiner, Loeb discloses that the pseudonym IF and the encrypted user 
profile is transmitted to the filter station. As taught above, there is no teaching or suggestion 
that the pseudonym LP and the user profile are associated. In fact, the two are clearly distinct 
entities that are transmitted together. If the user profile and the pseudonym LP were 
associated, encrypting one would necessarily encrypt the other. However, Loeb clearly 
teaches encrypting, and doubly encrypting the user profile Pr, with no mention of encryption 
the pseudonym U\ Thus, the pseudonym IP is a separate entity that the Examiner has 
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interpreted to be the false user profile of the invention as claimed. Applicants respectfully 
submit that there is no teaching or disclosure in Loeb that the pseudonym LP contains at least 
one item of user identification data and at least one other item of user data. 

As such, since Loeb fails to teach or disclose that the false user profile contains at 
least one item of user identification data and at least one other item of user data, Loeb cannot 
anticipate dependent claims 13 and 16 (whereby dependent claim 16 recites similar features 
to those discussed above with respect to claim 13) for these further reasons. 

v. Dependent claims 14 and 17: 

Dependent claims 14 and 17 are patentable for additional reasons beyond the reasons 
given above for their respective base claim. Dependent claim 14 recites (with emphasis 
added): 

the system according to claim L wherein the false user profile contains at least one 
item of data from the true user profile corresponding to a user field and at least one 
item of false data corresponding to a different user field 

See, for example, the description on page 9 of the specification. 

As detailed above, there is no teaching or disclosure in Loeb that the pseudonym U' 
contains any information other than a translation of the user identity. Further, there is no 
indication that even if more than one item of information were stored in the false user profile, 
that at least one item of data would be factual, and at least one item of data would be false. 
There is no disclosure or teaching in Loeb that the pseudonym would hold factual 
information. In fact, this would contrast with the teachings of Loeb, which utilize a 
pseudonym separate from the user profile in order to mask the true user identity yet obtain 
accurate data. Thus, Loeb fails to teach that a false user profile would hold both factual and 
false data. 

The Examiner further asserts that "Loeb teaches that the fake user profile includes the 
encrypted user profile and the pseudonym (column 4, lines 26-28)." (item 5, lines 3-4 of the 
Office Action). However, Applicants respectfully disagree with this interpretation. As 
detailed above, the pseudonym LP is a separate entity that the Examiner has interpreted to be 
the false user profile of the invention as claimed. Applicants respectfully submit that there is 
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no teaching or disclosure in Loeb that the user profile contains at least one item of data from 
the true user profile corresponding to a user field and at least one item of false data 
corresponding to a different user field. 

As such, since Loeb fails to teach or disclose that the false user profile contains at 
least one item of data from the true user profile corresponding to a user field and at least one 
item of false data corresponding to a different user field, Loeb cannot anticipate dependent 
claims 14 and 17 (whereby dependent claim 14 recites similar features to those discussed 
above with respect to claim 17) for these further reasons. 

II. It is respectfully submitted that the final rejection of claims 6-8. 14, 20, and 28-30 under 
35 U.S.C. § 103(a) is erroneous for at least the following reason. 

Herz in no way makes up for the deficiencies of Loeb as described above. 

L Independent claims 1 and 8: 

Independent claim 1 recites (with emphasis added): 

A privacy protection system including a user side device (22) provided with a true 
user profile which comprises user related profile data, a profile generator (24) operable 
to generate at least one false user profile (26a-26c) which includes profile data not the 
same as the user's profile data, transmission means operable to transmit the at least one 
false user profile to a third party (14-18) with a data request, a receiving unit (28a-28c) 
operable to receive a response from the third party generated on the basis of the false user 
profile, and a response analyser (30) operable to determine from the received response a 
response related to the true user profile. 

There is no teaching or disclosure in Herz of a user side device provided with a true 
user profile which comprises user related profile data and a profile generator operable to 
generate at least one false user profile which includes profile data not the same as the user's 
profile data. Rather, Herz appears to be directed towards the customized electronic 
identification of desirable objects, such as news articles, in an electronic media environment, 
and in particular to a system that automatically constructs both a "target profile 1 ' for each 
target object in the electronic media based, for example, on the frequency with which each 
word appears in an article relative to its overall frequency of use in all articles, as well as a 
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"target profile interest summary" for each user, which target profile interest summary 
describes the user's interest level in various types of target objects (column 6, lines 32-58). 
The system then evaluates the target profiles against the users 1 target profile interest 
summaries to generate a user-customized rank ordered listing of target objects most likely to 
be of interest to each user so that the user can select from among these potentially relevant 
target objects, which were automatically selected by this system from the plethora of target 
objects that are profiled on the electronic media. (Abstract) 

The Examiner utilized Herz to teach the features of the false user profile and the 
response analyser as represented by dependent claims 3-5. Given the teachings of Herz, it is 
clear that Herz does not make up for the deficiencies of Loeb as shown above. Herz fails to 
teach a true user profile and false user profiles of the invention as claimed. Herz teaches a 
partial user profile (column 5, lines 61-62) that contains only part of the information of a user 
profile. This is in no way equivalent to generating a false user profile of the invention as 
claimed. 

Further, the outstanding Office Action asserts that "Loeb and Herz are analogous art 
because they are from the same field of endeavor, pseudonyms in electronic transactions. At 
the time of the invention, it would have been obvious to one of ordinary skill in the art, 
having the teachings of Loeb or Herz before him or her, to modify Loeb to include the 
interpolation and random generation of Herz." (item 23, lines 1-5 of the Office Action). 
However, it is respectfully submitted that the combination of the teachings of Loeb with those 
of Herz would not be obvious to one skilled in the art. 

Loeb teaches generating a description of services in response to receiving a 
pseudonym U 5 related to an end-user station. One of ordinary skill in the art at the time of the 
invention would not think it obvious to modify Loeb to include interpolation and random 
generation of pseudonyms. Loeb explicitly teaches mapping an end-user identity U to a 
pseudonym U\ There would be no reason for Loeb to randomly generate pseudonyms. In 
fact, that would be in contrast to the teachings of Loeb. Further, there would be no need in 
Loeb to utilize interpolation of the response. Thus, Applicants respectfully submit that there 
would be no need or motivation for one of ordinary skill in the art at the time the invention 
was made to modify Loeb to include the teachings of Herz. Moreover, even when such a 
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combination is made, it is still missing the claim elements of the invention as claimed, 
specifically failing to teach or disclose a "privacy protection system including a user side 
device (22) provided with a true user profile which comprises user related profile data, a 
profile generator (24) operable to generate at least one false user profile (26a-26c) which 
includes profile data not the same as the user's profile data, transmission means operable 
to transmit the at least one false user profile to a third party (14-18) with a data request, a 
receiving unit (28a-28c) operable to receive a response from the third party generated on the 
basis of the false user profile, and a response analyser (30) operable to determine from the 
received response a response related to the true user profile.." 

Consequently, the combination of Herz with Loeb is improper and the motivation to 
make such a combination is lacking. As such, the combined teachings of Loeb and Herz 
cannot do not teach the features of pending claims 1-17. 
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CONCLUSION 

In view of the above, Appellants respectfully solicit the Honorable Board of Patent 
Appeals and Interferences to reverse the rejections of the pending claims and pass this 
application on to allowance. 

Respectfully submitted, 

Date 1^l~2^[€>i 

HEWLETT-PACKARD COMPANY 
Customer Number: 22879 
Telephone: (202) 672-5485 
Facsimile: (202) 672-5399 




rer/ William T. Ellis 

Attorney for Applicant 
Registration No. 26,874 
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CLAIMS APPENDIX 

1 . (Original) A privacy protection system including a user side device (22) 
provided with a true user profile which comprises user related profile data, a profile generator 
(24) operable to generate at least one false user profile (26a-26c) which includes profile data 
not the same as the user's profile data, transmission means operable to transmit the at least 
one false user profile to a third party (14-18) with a data request, a receiving unit (28a-28c) 
operable to receive a response from the third party generated on the basis of the false user 
profile, and a response analyser (30) operable to determine from the received response a 
response related to the true user profile. 

2. (Original) A system according to claim 1, wherein the profile generator (24) is 
operable: 

a) to generate a plurality of user profiles of which only one is a true user 

profile, or 

b) to generate a plurality of user profiles none of which includes a true 

user profile, or 

c) to split user data forming the true user profile into separate parts with 
the separate parts being included in false user profiles to which are added false user data, or 

d) to generate entirely false profiles none of which contains any true user 

data. 
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3. (Original) A system according to claim 1, wherein the profile generator is 
operable to generate a plurality of false user profiles which provide a spread of user data 
enabling interpolation of the received responses. 

4. (Original) A system according to claim 3, wherein the false user profiles are 
generated on a random basis. 

5. (Previously Presented) A system according to claim 1, wherein the response 
analyser is operable to extrapolate or interpolate from the received responses in order to 
generate an estimated response for the true user profile. 

6. (Previously Presented) A system according to claim 1, wherein the system is 
operable to receive responses over a period of time. 

7. (Previously Presented) A system according to claim 1, wherein the user profile 
generator is provided in a user's communication device or is provided at a location remote 
from the user. 

8. (Original) A privacy protection method including the steps of providing at a 
user side a true user profile (22) comprising user related profile data, providing a profile 
generator (24) which generates at least one false user profile (26a-26c) which includes profile 
data not the same as the true user profile data, transmitting (42) the at least one false user 
profile to a third party (14-18) with a data request, receiving (44) a response (28c-28c) from 
the third party generated on the basis of the false user profile, and providing a response 
analyser (30) which analyses the response to determine from the received response a response 
related to the true user profile. 

9. (Original) A method according to claim 8, wherein: 
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a) a plurality of user profiles is generated of which only one is a true user 

profile, or 

b) a plurality of user profiles is generated none of which includes a true 

user profile, or 

c) entirely false profiles are generated none of which contains true user 

data, or 

d) a plurality of false user profiles are generated which provide a spread 
of user data enabling interpolation of the received responses. 

10. (Previously Presented) A computer including a privacy protection system 
according to claim 1 . 

1 1 . (Original) A computer according to claim 10, wherein the computer is a 
personal computer, a portable computer, a hand held computer, a personal digital assistant or 
a mobile telephone. 

12. (Previously Presented) The system according to claim 1, wherein said 
transmission means are operable to transmit a plurality of false user profiles to a third party 
(14-18) with a data request. 

13. (Previously Presented) The system according to claim 1, wherein the false user 
profile contains at least one item of user identification data and at least one other item of user 
data. 
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14. (Previously Presented) The system according to claim 1, wherein the false user 
profile contains at least one item of data from the true user profile corresponding to a user 
field and at least one item of false data corresponding to a different user field. 

15. (Previously Presented) The method according to claim 8, wherein said 
transmission means are operable to transmit a plurality of false user profiles to a third party 
(14-18) with a data request. 

16. (Previously Presented) The method according to claim 8, wherein the false user 
profile contains at least one item of user identification data and at least one other item of user 
data. 

17. (Previously Presented) The method according to claim 8, wherein the false 
user profile contains at least one item of data from the true user profile corresponding to a 
user field and at least one item of false data corresponding to a different user field. 
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EVIDENCE APPENDIX 

[None] 
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RELATED PROCEEDINGS APPENDIX 

[None] 
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